Skip to main content

BLACKBAUD INC

For the period ended Dec 31, 2024. Filed Feb 21, 2025.

View on SEC.gov

About this filing

A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.

FY2024 · Filed Feb 21, 2025

BLKB$54.12-3.0%Stored close · as of Nov 6, 2026

What changed in Risk Factors?

Read the current filing

Previous report: 10-K

Period ended 2023-12-31; filed 2024-02-21.

0001280058-24-000013

Item 1A. Risk factors

Current report: 10-K

Period ended 2024-12-31; filed 2025-02-21.

0001280058-25-000010

Item 1A. Risk factors

The baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.

Compared 135 previous paragraphs and 143 current paragraphs.

99 unchanged; 34 reworded; 7 added; 2 removed; 0 previous and 3 current paragraphs rearranged.

Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.

A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.

Added paragraphs (7)

Current report

Changes in the US federal or state governmental grant, award or other funding programs could negatively impact the operations of our nonprofit customers, which could have a material adverse effect on our business, results of operations, financial condition and liquidity.

Current report

Many of our customers depend in significant part on the US federal and state governments for grants, awards and other funding to maintain their operations. Changes in, or uncertainty regarding, the availability, amount or conditions and restrictions related to such funding could negatively impact our customers’ willingness or ability to purchase our various software solutions due to resulting budgetary or investment capital concerns. Our customers and we must identify, assess and respond to new developments and trends in the legislative, regulatory and political environment while federal and state governments and agencies consider and implement potential funding changes that could materially impact various aspects of the nonprofits’ operations and financial health. We cannot predict the specific terms of any such proposals or changes, whether or when they will be implemented, or their effect on our operations. Certain proposals or changes could, if implemented, have an adverse, material impact on our business, results of operations, financial condition or liquidity.

Current report

•greater risk of failure to comply with foreign country employment or other human resources laws and regulations;

Current report

In addition,

Current report

•On May 20, 2024, the U.S. Federal Trade Commission (the "FTC") finalized an Order (the “FTC Order”) evidencing its settlement with us in connection with the Security Incident;

Current report

•On June 13, 2024, we agreed to a Final Judgment and Permanent Injunction with the Attorney General of the State of California (the "California Judgment") relating to the Security Incident; and

Current report

For example, on July 19, 2024, CrowdStrike Holdings, Inc. (“CrowdStrike”), which provides cybersecurity services to millions of Microsoft Windows systems worldwide, including to certain Windows systems operated by Blackbaud, implemented a software update to its Falcon sensor software that was flawed and caused Falcon to crash, thereby causing widespread crashes of Windows systems into which it was integrated, including certain Windows systems used by us and certain of our customers (the “CrowdStrike Event”). As a result, some of our customers were unable to access certain of our services and solutions, including our payments processing solutions. We evaluated the actual impact of the CrowdStrike Event on Blackbaud, both directly and indirectly due to the impact on our customers, and deemed it to be immaterial.
Removed paragraphs (2)

Previous report

As previously disclosed, on February 1, 2024, the FTC announced its approval of an Agreement Containing Consent Order (the “Proposed Order”) evidencing its settlement with the Company in connection with the Security Incident. Pursuant to its rules, the FTC placed the Proposed Order and related draft complaint on the public record for a period of 30 days for the receipt of public comments after which the FTC will consider any comments received from interested persons prior to determining whether and in what form to finalize the Proposed Order. The 30-day comment period is scheduled to expire on March 14, 2024. As part of the FTC’s proposed order, the Company has not been fined and is not otherwise required to make any payment. Furthermore, the Company has agreed to the FTC’s proposed order without admitting or denying any of the FTC’s allegations, except as expressly stated otherwise in the Proposed Order. If finalized, the settlement described in the Proposed Order will fully resolve the FTC investigation. Although we believe the Proposed Order will be finalized in substantially its current form, there can be no assurances as to whether that will occur or its timing. Under the terms of the Proposed Order, we have agreed (i) to not misrepresent (a) the extent to which we maintain, use, delete or disclose certain customer information, (b) the extent to which we protect the privacy, security, availability, confidentiality or integrity of such information or (c) the extent of any security incident or unauthorized disclosure, misuse, loss, theft, alteration, destruction or other compromise of such information, and (ii) to delete certain data, adopt and make public certain record retention limits, establish, implement and maintain a specified information security program, obtain regular independent assessments of the mandated information security program, provide to the FTC specified certifications regarding our compliance with the Proposed Order, provide to the FTC reports of any future security incidents and create and maintain specified recordkeeping. The form of Proposed Order was furnished as Exhibit 99.2 to the Company’s Current Report on Form 8-K filed with the SEC on February 2, 2024.

Previous report

In addition, changes in certain laws, regulations or policies could impact our customers, alter our business environment and limit our operations. For example, various financial institutions subscribe to our EVERFI training solution, which they may then provide free of charge to schools in low-income and moderate-income communities as a means of satisfying their obligations under the Community Reinvestment Act of 1977, as amended (the “CRA”). Repeal or significant modification of the CRA or the many government agency regulations and policies implementing its provisions could cause financial institutions to limit or eliminate their purchases of these EVERFI solutions and thereby negatively impact our operating results and financial condition.
Reworded paragraphs (34)

Previous wording

In addition, the introduction of solutions encompassing new technologies can render existing solutions obsolete and unmarketable. As a result, our future success will depend, in part, upon our ability to continue to enhance existing solutions and develop and introduce in a timely manner or acquire new solutions that keep pace with technological developments, satisfy increasingly sophisticated customer requirements and achieve market acceptance. If we are unable to develop or acquire on a timely and cost-effective basis new software solutions or enhancements to existing solutions or if such new solutions or enhancements do not achieve market acceptance, we may be unable to compete successfully and our business, results of operations and financial condition may be materially adversely affected.

Current wording

In addition, the introduction of solutions encompassing new technologies, such as AI, can render existing solutions obsolete and unmarketable. As a result, our future success will depend, in part, upon our ability to continue to enhance existing solutions and develop and introduce in a timely manner or acquire new solutions that keep pace with technological developments, satisfy increasingly sophisticated customer requirements and achieve market acceptance. If we are unable to develop or acquire on a timely and cost-effective basis new software solutions or enhancements to existing solutions or if such new solutions or enhancements do not achieve market acceptance, we may be unable to compete successfully and our business, results of operations and financial condition may be materially adversely affected.

Previous wording

Further, we use equity incentive programs and equity awards in lieu of cash as part of our overall employee compensation agreements to both attract and retain personnel. A decline in our stock price could negatively impact the value of these equity incentive and related compensation programs as retention and recruiting tools. We may need to create new or additional equity incentive programs and/or compensation packages to remain competitive, which could be dilutive to our existing stockholders and/or adversely affect our results of operations.

Current wording

Further, we use equity incentive programs and equity awards in lieu of cash as part of our overall employee compensation agreements to both attract and retain personnel. A decline in our stock price could negatively impact the effectiveness of these equity incentive and related compensation programs as retention and recruiting tools. We may need to create new or additional equity incentive programs and/or compensation packages to remain competitive, which could be dilutive to our existing stockholders and/or adversely affect our results of operations.

Previous wording

We are incorporating generative artificial intelligence, or AI, technology into certain of our products and services. This technology is new and developing, and while we aim to adopt known best practices, it may result in operational, financial and reputational harm and other adverse consequences to our business.

Current wording

We are incorporating generative AI technology into certain of our solutions and services. This technology is new and developing, and while we aim to adopt known best practices, it may result in operational, financial and reputational harm and other adverse consequences to our business.

Previous wording

We are implementing AI features in certain of our products and services. The technologies underpinning these features are in the early stages of commercial use and exist in an emerging regulatory environment, which presents regulatory, litigation, ethical, reputational, operational and financial risks. Many U.S. and international governmental bodies and regulators have proposed, or are in the process of developing, new regulations related to the use of AI and machine learning technologies. The final form of these may impose obligations related to our development, offering and use of AI technologies and expose us to increased risk of regulatory enforcement and litigation. We also expect that many of our generative AI features will include the processing of personal data and may be subject to laws, policies, legal obligations and codes of conduct related to privacy and data protection. There is uncertainty about the extent to which privacy and data protection laws apply to AI technologies, and any delay in addressing privacy or data protection concerns relating to our AI features may result in liability or regulatory investigations and fines, as well as harm to our sales and reputation. In addition, issues relating to intellectual property rights in AI-generated content have not been fully addressed by the courts, laws or regulations. Accordingly, the implementation of generative AI technologies into our products and services may result in exposure to claims related to copyright infringement or other intellectual property misappropriation.

Current wording

We are implementing AI features in certain of our solutions and services. The technologies underpinning these features are in the early stages of commercial use and exist in an emerging regulatory environment, which presents regulatory, litigation, ethical, reputational, operational and financial risks. Many U.S. and international governmental bodies and regulators have adopted, or are in the process of developing, new regulations related to the use of AI and machine learning technologies. These have imposed, and may in the future further impose, obligations related to our development, offering and use of AI technologies and expose us to increased risk of regulatory enforcement and litigation. Many of our generative AI features include the processing of personal data and are, and may be further, subject to laws, policies, legal obligations and codes of conduct related to privacy and data protection. There is uncertainty about the extent to which privacy and data protection laws apply to AI technologies, and any delay in addressing privacy or data protection concerns relating to our AI features may result in liability or regulatory investigations and fines, as well as harm to our sales and reputation. In addition, issues relating to intellectual property rights in AI-generated content have not been fully addressed by the courts, laws or regulations. Accordingly, the implementation of generative AI technologies into our products and services may result in exposure to claims related to copyright infringement or other intellectual property misappropriation.

Previous wording

We currently have non-U.S. operations primarily in the U.K., Canada, Australia and Costa Rica, and we intend to expand further into international markets. Expansion of our international operations will require a significant amount of attention from our management and substantial financial resources and might require us to add qualified management in these markets. Our direct sales model requires us to attract, retain and manage qualified sales personnel capable of selling into markets outside the United States. In some cases, our costs of sales might increase if our customers require us to sell through local distributors. If we are unable to grow our international operations in a cost-effective and timely manner, our business and operating results could be harmed.

Current wording

We currently have non-U.S. operations primarily in the U.K., Canada, Australia, Costa Rica and India, and we intend to expand further into international markets. Expansion of our international operations has required, and will continue to require, a significant amount of attention from our management and substantial financial resources and might require us to add qualified management in these markets. For example, we are currently expanding our operations in India, which we expect will give us greater access to talent, and increase the number of our employees, including management, in India. We have rented office space in India to accommodate those new operations, although we do not currently expect to generate revenue in India in the foreseeable future. Our direct sales model requires us to attract, retain and manage qualified sales personnel capable of selling into markets outside the United States. In some cases, our costs of sales might increase if our customers require us to sell through local distributors. If we are unable to grow our international operations in a cost-effective and timely manner, our business and operating results could be harmed.

Previous wording

Increases in our international revenues denominated in foreign currencies subject us to fluctuations in foreign currency exchange rates. If we expand our international operations, exposures to gains and losses on foreign currency transactions may increase. (See Foreign Currency Exchange Rates on page 59 for more information regarding the impact of foreign currency exchange rates on our operations.)

Current wording

Increases in our international revenues denominated in foreign currencies subject us to fluctuations in foreign currency exchange rates. The expansion of our international operations has increased, and is expected to continue to increase, our exposures to gains and losses on foreign currency transactions. (See Foreign Currency Exchange Rates on page 59 for more information regarding the impact of foreign currency exchange rates on our operations.)

Previous wording

•the imposition of additional withholding taxes or other tax on our foreign income, tariffs or restrictions on foreign trade or investment, including currency exchange controls;

Current wording

•the imposition of additional withholding taxes or other tax on our foreign income, tariffs or restrictions on foreign trade or investment, including currency exchange and capital expropriation controls;

Previous wording

For example, following our acquisition of EVERFI, Inc. (as further described in Note 3 to our consolidate financial statements in this report) we experienced the loss of certain employees and unexpected delays in realizing anticipated returns on our investment.

Current wording

For example, following our acquisition of EVERFI, Inc ("EVERFI") in December 2021, we experienced the loss of certain employees and were unable to realize the anticipated returns on our investment prior to our disposition of the business in December 2024.

Previous wording

Acquisitions, including for example our acquisition of EVERFI, Inc., may also result in potentially dilutive issuances of equity securities, the incurrence of debt and contingent liabilities, the expenditure of available cash, and amortization expenses or write-downs related to intangible assets such as goodwill, any of which could have a material adverse effect on our operating results or financial condition. We may experience risks relating to the challenges and costs of closing a business combination and the risk that an announced business combination may not close. There can be no assurance that we will be successful in making additional acquisitions in the future or in integrating or executing on our business plan for existing or future acquisitions.

Current wording

We may experience risks relating to the challenges and costs of closing a business combination and the risk that an announced business combination may not close. There can be no assurance that we will be successful in making additional acquisitions in the future or in integrating or executing on our business plan for existing or future acquisitions.

Previous wording

As previously disclosed, on July 16, 2020, we contacted certain customers to inform them about the Security Incident, including that in May 2020 we discovered and stopped a ransomware attack. Prior to our successfully preventing the cybercriminal from blocking our system access and fully encrypting files, and ultimately expelling them from our system with no significant disruption to our operations, the cybercriminal removed a copy of a subset of data from our self-hosted environment that affected over 13,000 customers. Based on the nature of the incident, our research and third party (including law enforcement) investigation we believe that no data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly. However, our investigation into the Security Incident remains ongoing and may provide additional information.

Current wording

As previously disclosed, on July 16, 2020, we contacted certain customers to inform them about the Security Incident.

Previous wording

To date, we have received approximately 260 specific requests for reimbursement of expenses, approximately 214 (or 82%) of which have been fully resolved and closed and approximately 39 (or 15%) are inactive and are considered by us to have been abandoned by the customers. We have also received approximately 400 reservations of the right to seek expense recovery in the future from customers or their attorneys in the U.S., U.K. and Canada related to the Security Incident, none of which resulted in claims submitted to us and are considered by us to have been abandoned by the customers. We have also received notices of proposed claims on behalf of a number of U.K. data subjects, which we are reviewing. In addition, insurance companies representing various customers’ interests through subrogation claims have contacted us, and certain insurance companies have filed subrogation claims in court, of which 3 cases remain active and unresolved. Customer and insurer subrogation claims generally seek reimbursement of their costs and expenses associated with notifying their own customers of the Security Incident and taking steps to assure that personal information has not been compromised as a result of the Security Incident. In addition, presently, we are a defendant in putative consumer class action cases in U.S. federal courts (most of which have been consolidated under multi district litigation to a single federal court) and in Canadian courts alleging harm from the Security Incident. The plaintiffs in these cases, who generally purport to represent various classes of individual constituents of our customers, generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief. We have received a Civil Investigative Demand from the office of the California Attorney General relating to the Security Incident. In addition, we are subject to pending governmental actions or investigations by the U.S. Federal Trade Commission, the U.S. Department of Health and Human Services, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner of Canada. (See Note 11 to our consolidated financial statements included in this report for a more detailed description of the Security Incident and related matters.)

Current wording

To date, we have received approximately 260 specific requests from customers for reimbursement of expenses incurred by them related to the Security Incident, all of which have been fully resolved and closed or are inactive and are considered by us to have been abandoned by the customers. We have also received approximately 400 reservations of the right to seek expense recovery in the future from customers or their attorneys in the U.S., U.K. and Canada related to the Security Incident, none of which resulted in claims submitted to us and are considered by us to have been abandoned by the customers. We have also received notices of proposed claims on behalf of a number of U.K. data subjects, which have been fully resolved and closed or are inactive and are considered by us to have been abandoned by the data subjects. In addition, insurance companies representing various customers’ interests through subrogation claims have contacted us, and certain insurance companies have filed subrogation claims in court, of which two cases remain active and unresolved. We also were a defendant in putative consumer class action cases in Canadian courts alleging harm from the Security Incident which have now been resolved. In addition, presently, we are a defendant in putative consumer class action cases in U.S. federal courts (most of which have been consolidated under multi district litigation to a single federal court) alleging harm from the Security Incident. The plaintiffs in these cases, who generally purport to represent various classes of individual constituents of our customers, generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief. On May 14, 2024, the Court issued a memorandum opinion and order (1) denying the multi district litigation plaintiffs' motion for class certification, (2) granting our motion to exclude the multi district litigation plaintiffs' expert, (3) denying the multi district litigation plaintiffs' motion to exclude our expert and (4) denying all other pending motions. On July 30, 2024, the Fourth Circuit Court of Appeals denied the plaintiffs' petition for permission to appeal the Court's ruling. This litigation remains ongoing.

Previous wording

On March 9, 2023, the Company reached a settlement with the SEC in connection with the Security Incident. This settlement fully resolves the previously disclosed SEC investigation of the Security Incident and is further described in the SEC Order. Under the terms of the SEC Order, the Company agreed to cease-and-desist from committing or causing any violations or any future violations of Sections 17(a)(2) and (3) of the Securities Act and Section 13(a) of the Exchange Act, and Rules 12b-20, 13a-13 and 13a-15(a) thereunder. As part of the SEC Order, the Company also agreed to pay, and has paid, a civil penalty in the amount of $3.0 million.

Current wording

•On March 9, 2023, the Company reached a settlement with the SEC that fully resolved the previously disclosed SEC investigation of the Security Incident;

Previous wording

On October 5, 2023, the Company reached a settlement with each of 49 state Attorneys General and the District of Columbia in connection with the Security Incident. This settlement fully resolves the previously disclosed multi-state Civil Investigative Demand and the separate Civil Investigative Demand from the Office of the Indiana Attorney General relating to the Security Incident, which is further described in the substantially similar Administrative Orders filed in each of the 49 states and the District of Columbia. Under the terms of the Administrative Orders, we have agreed: (i) to comply with state consumer protection laws, data breach notification laws, and HIPAA; (ii) not to make misleading misrepresentations to our customers or the individuals whose data is stored by us concerning (a) the extent to which we protect the privacy, security, confidentiality, or integrity of certain data, (b) the likelihood that data impacted by a security incident may be subject to unauthorized access, disclosure, or other misuse, or (c) the data breach notification requirements; and (iii) to implement and improve certain cybersecurity programs and tools. As part of the Administrative Orders, we also agreed to pay, and have paid, a total of $49.5 million to the 49 states and District of Columbia. We paid the full settlement amount to each state and the District of Columbia during the fourth quarter of 2023 from our existing liquidity. This amount was fully accrued as a contingent liability in our financial statements as of June 30, 2023. We entered into the Administrative Orders without admitting fault of liability in connection with the matters subject to the Multistate Investigation. The form of Administrative Order was furnished as Exhibit 99.2 to the Company’s Current Report on Form 8-K filed with the SEC on October 5, 2023.

Current wording

•On October 5, 2023, the Company entered into separate, substantially similar Administrative Orders with each of 49 state Attorneys General and the District of Columbia that fully resolved the previously disclosed multi-state Civil Investigative Demand and the separate Civil Investigative Demand from the Office of the Indiana Attorney General relating to the Security Incident;

Previous wording

As noted above, the terms of the FTC Proposed Order, the Attorneys General Administrative Orders and our settlement with the SEC require that we implement and maintain certain processes and programs and comply with certain legal requirements related to cybersecurity and data protection. Any future regulatory investigation or litigation settlements may also contain such requirements. Effectively implementing, monitoring and updating these requirements is expected to be expensive and time-consuming over an extended period. Our failure to do so in accordance with the terms of our agreements with FTC, the Attorneys General and with the SEC, and possibly others, could expose us to additional material liability under the terms of the Administrative Orders, the SEC settlement, or otherwise.

Current wording

The terms of the California Judgment, FTC Order, the Attorneys General Administrative Orders and our settlement with the SEC require that we implement and maintain certain processes and programs and comply with certain legal requirements related to cybersecurity and data protection. Any future regulatory investigation or litigation settlements may also contain such requirements. Effectively implementing, monitoring and updating these requirements has been, and is expected to be over an extended period of time, expensive and time-consuming. Our failure to do so in accordance with the terms of our agreements with FTC, the Attorneys General and with the SEC, and possibly others, could expose us to additional material liability under the terms of the Administrative Orders, the SEC settlement, or otherwise.

Previous wording

We may be named as a party in additional lawsuits, other claims may be asserted by or on behalf of our customers or their constituents, and we may be subject to additional governmental inquires, requests or investigations. Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses that will not be covered by insurance. It is reasonably possible that our estimated or actual losses may change in the near term for those matters and be materially more than the amounts accrued. Certain governmental authorities are seeking to impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our data security costs or otherwise require us to alter how we operate our business. Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations.

Current wording

We may be named as a party in additional lawsuits, other claims may be asserted by or on behalf of our customers or their constituents, and we may be subject to additional governmental inquiries, requests or investigations. Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses that will not be covered by insurance. It is reasonably possible that our estimated or actual losses may change in the near term for those matters and be materially in excess of the amounts accrued. Certain governmental authorities have imposed, and others may in the future impose, undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which have materially increased our data security costs or otherwise required us to alter how we operate our business, and could further do so in the future. Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations.

Previous wording

Significant management time and Company resources have been, and are expected to continue to be, devoted to the Security Incident. For example, for full year 2023, we incurred net pre-tax expenses of $53.4 million related to the Security Incident, which included $22.4 million for ongoing legal fees and $31.0 million for settlements and recorded liabilities for loss contingencies. During 2023, we had net cash outlays of $78.0 million related to the Security Incident, which included ongoing legal fees, the $3.0 million civil penalty paid during the first quarter of 2023 related to the SEC settlement and the $49.5 million civil penalty paid during the fourth quarter of 2023 related to the Multistate Investigation (as discussed in Note 11). Although we carry insurance against certain losses related to the Security Incident, we exceeded the limit of that insurance coverage in the first quarter of 2022. As a result, we will be responsible for all expenses or other losses (including penalties, fines or other judgments) or all types of claims that may arise in connection with the Security Incident, which could materially and adversely affect our liquidity and results of operations. (See Note 11 to our consolidated financial statements included in this report.) If any such fines or penalties were great enough that we could not pay them through funds generated from operating activities and/or cause a default under the 2020 Credit Facility, we may be forced to renegotiate or obtain a waiver under the 2020 Credit Facility and/or seek additional debt or equity financing. Such renegotiation or financing may not be available on acceptable terms, or at all. In these circumstances, if we were unable to obtain sufficient financing, we may not be able to meet our obligations as they come due.

Current wording

Significant management time and Company resources have been, and are expected to continue to be, devoted to the Security Incident. For example, for full year 2024, we incurred net pre-tax expenses of $13.7 million related to the Security Incident, which included $7.0 million for ongoing legal fees and $6.8 million for settlements and recorded liabilities for loss contingencies. During 2024, we had net cash outlays of $15.9 million related to the Security Incident, which included ongoing legal fees, and the $6.8 million paid during the third quarter of 2024 related to our settlement with the Attorney General of the State of California (as discussed in Note 11). Although we carry insurance against certain losses related to the Security Incident, we exceeded the limit of that insurance coverage in the first quarter of 2022. As a result, we will be responsible for all expenses or other losses (including penalties, fines or other judgments) or all types of claims that may arise in connection with the Security Incident, which could materially and adversely affect our liquidity and results of operations. (See Note 11 to our consolidated financial statements included in this report.) If any such fines or penalties were great enough that we could not pay them through funds generated from operating activities and/or cause a default under the 2024 Credit Facilities, we may be forced to renegotiate or obtain a waiver under the 2024 Credit Facilities and/or seek additional debt or equity financing. Such renegotiation or financing may not be available on acceptable terms, or at all. In these circumstances, if we were unable to obtain sufficient financing, we may not be able to meet our obligations as they come due.

Previous wording

Expected new regulations and standards relating to public disclosure, including those related to climate change, could adversely impose significant costs on us to comply with such regulations.

Current wording

New regulations and standards relating to public disclosure, including proposed new rules related to climate change, could adversely impose significant costs on us to comply with such regulations.

Previous wording

Because our customers use these services for important aspects of their businesses, any defects, delays or disruptions in service or other performance problems with our services could hurt our reputation and damage our customers' businesses. If that occurs, customers could elect to cancel their service, delay or withhold payment to us, not purchase from us in the future or make claims against us, which could result in an increase in our provision for credit losses, an increase in collection cycles for accounts receivable or the expense and risk of litigation. Any of these could harm our business and reputation.

Current wording

Because our customers use these services for important aspects of their businesses, any defects, delays or disruptions in service or other performance problems with our services, such as the CrowdStrike Event, could hurt our reputation and damage our customers' businesses. If that occurs, customers could elect to cancel their service, delay or withhold payment to us, not purchase from us in the future or make claims against us, which could result in an increase in our provision for credit losses, an increase in collection cycles for accounts receivable or the expense and risk of litigation. Any of these could harm our business and reputation.

Previous wording

We significantly increased our leverage in connection with acquisition of EVERFI and may increase our leverage in the future in connection with additional acquisitions, Security Incident costs or other business purposes, which could adversely impact our business and financial performance.

Current wording

We significantly increased our leverage in connection with stock repurchases, and may increase our leverage in the future in connection with acquisitions, Security Incident costs or other business purposes, which could adversely impact our business and financial performance.

Previous wording

We incurred a substantial amount of indebtedness in connection with acquisitions, including our acquisition of EVERFI, Inc. (as described in Note 3 to our consolidated financial statements included in this report). As a result of this indebtedness, our interest payment obligations have increased. In addition, we have been named as a party in various lawsuits in connection with the Security Incident, claims have been asserted by or on behalf of our customers or their constituents, and we are subject to various governmental inquires, requests or investigations. Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses. Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations, which could require that we incur additional indebtedness to fund. (See Note 11 to our consolidated financial statements in this report for additional information regarding the Security Incident.)

Current wording

We incurred a substantial amount of indebtedness to fund the ASR Transaction (as defined on page 105) and other stock repurchases. As a result of this indebtedness and other borrowings, our interest payment obligations have increased. In addition, we have been named as a party in various lawsuits in connection with the Security Incident, claims have been asserted by or on behalf of our customers or their constituents, and we are subject to various governmental inquiries, requests or investigations. Responding to and resolving these current and any future lawsuits, claims and/or investigations has resulted, and may continue to result, in material remedial and other expenses. Although we have defended, and intend to continue to defend, ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations, which could require that we incur additional indebtedness to fund. (See Note 11 to our consolidated financial statements in this report for additional information regarding the Security Incident.)

Previous wording

In addition, additional leverage could impact our ability to meet certain financial and other covenants contained in our 2020 Credit Facility. (See Note 9 to our consolidated financial statements included in this report for a more detailed description of our 2020 Credit Facility.) There can be no assurance that we will be able to remain in compliance with the covenants to which we are now subject or may be subject in the future and, if we fail to do so, that we will be able to obtain waivers from our lenders or amend the covenants.

Current wording

In addition, additional leverage could impact our ability to meet certain financial and other covenants contained in our 2024 Credit Facilities, which increased our total borrowing capacity from $1.1 billion to $1.5 billion. (See Note 9 to our consolidated financial statements included in this report for a more detailed description of our 2024 Credit Facilities.) There can be no assurance that we will be able to remain in compliance with the covenants to which we are now subject or may be subject in the future and, if we fail to do so, that we will be able to obtain waivers from our lenders or amend the covenants.

Previous wording

In the event of a default under our 2020 Credit Facility, we could be required to immediately repay all outstanding borrowings, which we might not be able to do and which would materially negatively affect our business, operations and financial condition.

Current wording

In the event of a default under our 2024 Credit Facilities, we could be required to immediately repay all outstanding borrowings, which we might not be able to do and which would materially negatively affect our business, operations and financial condition.

Previous wording

Our balance sheet includes significant amounts of goodwill and intangible assets. The impairment of a significant portion of these assets could negatively affect our operating results.

Current wording

Our balance sheet includes significant amounts of goodwill and intangible assets. The impairment of a significant portion of these assets, such as the EVERFI impairment charges, could negatively affect our operating results.

Previous wording

As of December 31, 2023, we had $1.1 billion and $581.9 million of goodwill and intangible assets, respectively. On at least an annual basis, we assess whether there have been impairments in the carrying value of goodwill and intangible assets. If the carrying value of an asset is determined to be impaired, then it is written down to fair value by a non-cash charge to operating earnings. Changes in circumstances that could indicate that the carrying value of goodwill or intangible assets may not be recoverable include declines in our stock price, market capitalization, cash flows and slower growth rates in our industry. We cannot accurately predict the likelihood or potential amount and timing of any impairment of goodwill or other intangible assets. An impairment of a significant portion of goodwill or intangible assets could materially and negatively affect our results of operations and financial condition.

Current wording

As of December 31, 2024, we had $1.1 billion and $132.9 million of goodwill and intangible assets, respectively. On at least an annual basis, we assess whether there have been impairments in the carrying value of goodwill and intangible assets. If the carrying value of an asset is determined to be impaired, then it is written down to fair value by a noncash charge to operating earnings. Changes in circumstances that could indicate that the carrying value of goodwill or intangible assets may not be recoverable include declines in our stock price, market capitalization, cash flows and slower growth rates in our industry. We cannot accurately predict the likelihood or potential amount and timing of any impairment of goodwill or other intangible assets. An impairment of a significant portion of goodwill or intangible assets, such as the EVERFI impairment charges discussed in Note 4 to our consolidated financial statements in this report, could materially and negatively affect our results of operations and financial condition.

Previous wording

We cannot guarantee that our stock repurchase program will be fully consummated or that it will enhance long-term stockholder value. Stock repurchases could also increase the volatility of the trading price of our stock and will diminish our cash reserves.

Current wording

We cannot guarantee that our stock repurchase program will be fully consummated or that it will enhance long-term stockholder value. Stock repurchases could also increase the volatility of the trading price of our stock and will diminish our cash reserves and increase our debt.

Previous wording

Although our board of directors has authorized a stock repurchase program that does not have an expiration date, the program does not obligate us to repurchase any specific dollar amount or to acquire any specific number of shares of our common stock. We have, from time to time, repurchased stock under this program and re-initiated repurchases under the program in the fourth quarter of 2023 after a two-year hiatus. We cannot guarantee that the program will be fully consummated or that it will enhance long-term stockholder value. The program could affect the trading price of our stock and increase volatility, and any announcement of a termination of this program may result in a decrease in the trading price of our stock. In addition, implementation of some or all of this program diminishes our cash reserves, which may impact our ability to finance future growth, to pursue possible future strategic opportunities and acquisitions and fund liabilities and expenses related to the Security Incident. (See Note 14 to our consolidated financial statements in this report for additional information related to our stock repurchase program.)

Current wording

Although our board of directors has authorized a stock repurchase program that does not have an expiration date, the program does not obligate us to repurchase any specific dollar amount or to acquire any specific number of shares of our common stock. We have, from time to time, repurchased stock under this program and re-initiated repurchases under the program in the fourth quarter of 2023 after a two-year hiatus. We cannot guarantee that the program will be fully consummated or that it will enhance long-term stockholder value. The program could affect the trading price of our stock and increase volatility, and any announcement of a termination of this program may result in a decrease in the trading price of our stock. In addition, implementation of some or all of this program diminishes our cash reserves and/or increases our debt, which may impact our ability to finance future growth, to pursue possible future strategic opportunities and acquisitions and fund liabilities and expenses related to the Security Incident. (See Note 14 to our consolidated financial statements in this report for additional information related to our stock repurchase program, including authorization amount, shares purchased, amounts paid and shares remaining available for purchase.)

Previous wording

As of December 31, 2023, we had deferred tax assets of $143.3 million. Realization of our deferred tax assets is dependent upon our generating sufficient taxable income in future years to realize the tax benefit from those assets. Deferred tax assets are reviewed at least annually for realizability. A charge against our earnings would result if, based on the available evidence, it is more likely than not that some portion of the deferred tax asset will not be realized beyond our existing valuation allowance. This could be caused by, among other things, deterioration in performance, adverse market conditions, adverse changes in applicable laws or regulations, including changes that restrict the activities of or affect the solutions sold by our business and a variety of other factors. If a deferred tax asset net of our valuation allowance was determined to be not realizable in a future period, the charge to earnings would be recognized as an expense in our results of operations in the period the determination is made. Additionally, if we are unable to utilize our deferred tax assets, our cash flow available to fund operations could be adversely affected.

Current wording

As of December 31, 2024, we had deferred tax assets of $162.3 million. Realization of our deferred tax assets is dependent upon our generating sufficient taxable income in future years to realize the tax benefit from those assets. Deferred tax assets are reviewed at least annually for realizability. A charge against our earnings would result if, based on the available evidence, it is more likely than not that some portion of the deferred tax asset will not be realized beyond our existing valuation allowance. This could be caused by, among other things, deterioration in performance, adverse market conditions, adverse changes in applicable laws or regulations, including changes that restrict the activities of or affect the solutions sold by our business and a variety of other factors. If a deferred tax asset net of our valuation allowance was determined to be not realizable in a future period, the charge to earnings would be recognized as an expense in our results of operations in the period the determination is made. Additionally, if we are unable to utilize our deferred tax assets, our cash flow available to fund operations could be adversely affected.

Previous wording

The effectiveness of our software solutions relies on our customers' storage and use of data concerning their customers, including financial, personally identifying or other sensitive data. Our customers' collection and use of this data for donor profiling, data analytics or communications outreach might raise privacy and data protection concerns and negatively impact the demand for our solutions and services. For example, our custom modeling and analytical services rely heavily on processing and using of data we gather from customers and various sources. Privacy and data protection laws could add restrictions or regulatory burdens, which could limit our ability to market and profit from those services.

Current wording

The effectiveness of our software solutions relies on our customers' storage and use of data concerning their customers, including financial, personally identifying or other sensitive data. Our customers' collection and use of this data for donor profiling, data analytics or communications outreach might raise privacy and data protection concerns and negatively impact the demand for our solutions and services. For example, our custom modeling and analytical services rely heavily on processing and using data we gather from customers and various sources. Privacy and data protection laws could add restrictions or regulatory burdens, which could limit our ability to market and profit from those services.

Previous wording

Governments in some jurisdictions have enacted or are considering enacting consumer data privacy or data protection legislation, including laws and regulations applying to the solicitation, collection, transfer, processing and use of personal data. This legislation could reduce the demand for our software solutions if we fail to design or enhance our solutions to enable our customers to comply with the privacy and data protection measures required by the legislation. Moreover, we may be exposed to liability under existing or new consumer privacy or data protection legislation. For example, when providing our solutions to certain customers in the healthcare industry, we must comply with applicable provisions of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and might be subject to similar provisions of other legislation, including, without limitation, the Gramm-Leach-Bliley Act and related regulations, and the California Consumer Privacy Act of 2018, which became effective January 1, 2020, and may apply to some of our customers and areas of business. Even technical violations of these laws may result in penalties that are assessed for each non-compliant transaction.

Current wording

Governments in some jurisdictions have enacted or are considering enacting consumer data privacy or data protection legislation, including laws and regulations applying to the solicitation, collection, transfer, processing and use of personal data. This legislation could reduce the demand for our software solutions if we fail to design or enhance our solutions to enable our customers to comply with the privacy and data protection measures required by the legislation. Moreover, we may be exposed to liability under existing or new consumer privacy or data protection legislation. For example, when providing our solutions to certain customers in the healthcare industry, we must comply with applicable provisions of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and might be subject to similar provisions of other legislation, including, without limitation, the Gramm-Leach-Bliley Act and related regulations, and the California Consumer Privacy Act of 2018, and may apply to some of our customers and areas of business. Even technical violations of these laws may result in penalties that are assessed for each non-compliant transaction.

Previous wording

Provisions in our organizational documents, our Stockholder Rights Agreement(as described below, the "Rights Agreement"), certain officer compensation arrangements and Delaware law may delay or prevent an acquisition or change of control of our Company that could be deemed beneficial to our stockholders.

Current wording

Provisions in our organizational documents, certain officer compensation arrangements and Delaware law may delay or prevent an acquisition or change of control of our Company that could be deemed beneficial to our stockholders.

Previous wording

Certain provisions in our organizational documents, the Rights Agreement, compensation arrangements with our officers and Delaware law (as summarized below) may have the effect of delaying, deferring, discouraging or preventing an acquisition or change in control of the Company or a change in our management. This includes tender offers for our common stock, proxy contests or other takeover attempts. These anti-takeover effects may discourage transactions that might result in the payment of a premium over the market price for shares of our common stock. Even in the absence of a takeover attempt, the existence of these provisions may adversely affect the prevailing market price of our common stock if they are viewed as discouraging takeover attempts in the future.

Current wording

Certain provisions in our organizational documents, compensation arrangements with our officers and Delaware law (as summarized below) may have the effect of delaying, deferring, discouraging or preventing an acquisition or change in control of the Company or a change in our management. This includes tender offers for our common stock, proxy contests or other takeover attempts. These anti-takeover effects may discourage transactions that might result in the payment of a premium over the market price for shares of our common stock. Even in the absence of a takeover attempt, the existence of these provisions may adversely affect the prevailing market price of our common stock if they are viewed as discouraging takeover attempts in the future.

Previous wording

The Board of Directors has the authority to issue up to an aggregate of 20,000,000 shares of preferred stock in one or more classes or series and to determine, with respect to any such class or series, the designations, powers, preferences and rights of such class or series, and the qualifications, limitations and restrictions thereof, including dividend rights, dividend rates, conversion rights, voting rights, terms of redemption (including sinking fund provisions), redemption prices, liquidation preferences, and the number of shares constituting any class or series or the designation of such class or series, without further vote or action by the stockholders. This preferred stock, including the Series A Preferred Stock described below, could have terms that may discourage a potential acquirer from making, without first negotiating with the Board of Directors, an acquisition attempt through which such acquirer may be able to change the composition of the Board of Directors, including a tender offer or other takeover attempt.

Current wording

The Board of Directors has the authority to issue up to an aggregate of 20,000,000 shares of preferred stock in one or more classes or series and to determine, with respect to any such class or series, the designations, powers, preferences and rights of such class or series, and the qualifications, limitations and restrictions thereof, including dividend rights, dividend rates, conversion rights, voting rights, terms of redemption (including sinking fund provisions), redemption prices, liquidation preferences, and the number of shares constituting any class or series or the designation of such class or series, without further vote or action by the stockholders. This preferred stock could have terms that may discourage a potential acquirer from making, without first negotiating with the Board of Directors, an acquisition attempt through which such acquirer may be able to change the composition of the Board of Directors, including a tender offer or other takeover attempt. See below for a discussion of our previously issued and subsequently cancelled Series A Preferred Stock.

Previous wording

Stockholder Rights Agreement. On October 7, 2022, the Company declared a dividend of one preferred share purchase right (a "Right") for each of the Company’s issued and outstanding shares of our common stock. The description and terms of these Rights are set forth in the Rights Agreement by and between the Company and American Stock Transfer & Trust Company, LLC. Each Right entitles the registered holder, subject to the terms of the Rights Agreement, to purchase from us one one-thousandth of a share of the Series A Junior Participating Preferred Stock, par value $0.001 per share (the “Series A Preferred Stock”) at a price of $313.00, subject to certain adjustments (as adjusted from time to time, the “Exercise Price”). Under the Rights Agreement, the Rights will become exercisable if an entity, person or group acquires beneficial ownership of 20% or more of the outstanding common stock in a transaction not approved by the Board of Directors. In the event that the Rights become exercisable due to the ownership threshold being crossed, each Right will entitle its holder (other than the person, entity or group triggering the Rights Plan, whose rights will become void and will not be exercisable) to purchase additional shares of our common stock having a then-current market value of twice the Exercise Price, which would likely make any takeover or change of control attempt by such entity, person or group prohibitively expensive. Subject to the terms of the Rights Agreement, the Rights were scheduled to expire on October 2, 2023. On October 2, 2023, the Company amended the Rights Agreement to extend the final expiration date from October 2, 2023 to October 2, 2024. The Company expects to submit this amendment to the Company’s stockholders for ratification at the Company’s 2024 annual meeting of stockholders. On January 26, 2024, the Company amended the Rights Agreement to reflect a change in rights agent. Additional information regarding the Rights Agreement and it amendments, including copies thereof, is contained in the Company’s Current Reports on Form 8-K filed with the SEC on October 7, 2022, October 2, 2023 and January 26, 2024.

Current wording

Stockholder Rights Agreement (the "Rights Agreement"). On October 7, 2022, the Company declared a dividend of one preferred share purchase right for each of the Company’s issued and outstanding shares of Common Stock. The description and terms of these Rights are set forth in the Rights Agreement by and between the Company and American Stock Transfer & Trust Company, LLC. Each Right entitled the registered holder, subject to the terms of the Rights Agreement, to purchase from us one one-thousandth of a share of the Series A Junior Participating Preferred Stock, par value $0.001 per share (the “Series A Preferred Stock”) at a price of $313.00, subject to certain adjustments (as adjusted from time to time, the “Exercise Price”). Under the Rights Agreement, the Rights would have become exercisable if an entity, person or group acquires beneficial ownership of 20% or more of the outstanding Common Stock in a transaction not approved by the Board of Directors. In the event that the Rights became exercisable due to the ownership threshold being crossed, each Right would have entitled its holder (other than the person, entity or group triggering the Rights Plan, whose rights would have become void and not exercisable) to purchase additional shares of Common Stock having a then-current market value of twice the Exercise Price, which would have likely made any takeover or change of control attempt by such entity, person or group prohibitively expensive. Subject to the terms of the Rights Agreement, the Rights were scheduled to expire on October 2, 2023. On October 2, 2023, the Company amended the Rights Agreement to extend the final expiration date from October 2, 2023 to October 2, 2024. On January 26, 2024, the Company amended the Rights Agreement to substitute Broadridge Corporate Issuer Solutions, LLC as the new rights agent under the Rights Agreement. On March 18, 2024, the Company terminated the Rights Agreement and eliminated the Series A Preferred Stock as a series of stock under its Amended and Restated Certificate of Incorporation. At the time of the termination of the Rights Agreement, all of the Rights expired. Additional information regarding the Rights Agreement and its termination, is contained in the Company’s Current Reports on Form 8-K filed with the SEC on October 2, 2023, January 26, 2024 and March 18, 2024 and in the Company's Form 8-A/A filed with the SEC on March 18, 2024.

Previous wording

We may also be subject to additional tax liabilities and penalties due to changes in non-income-based taxes resulting from changes in federal, state, local or international tax laws, changes in taxing jurisdictions’ administrative interpretations, decisions, policies and positions, results of tax examinations, settlements or judicial decisions, changes in accounting principles, or changes to our business operations, including as a result of acquisitions. For example, the U.S. Inflation Reduction Act of 2022 created an excise tax of 1% on the value of any stock repurchased by us after December 31, 2022. We could be subject to this excise tax, but the amount will vary depending on various factors, including the amount and frequency of any stock repurchases and any permitted reductions or exceptions to the amount subject to the tax. Any resulting increase in our tax obligation or cash taxes paid could adversely affect our financial position and cash flows.

Current wording

We may also be subject to additional tax liabilities and penalties due to changes in non-income-based taxes resulting from changes in federal, state, local or international tax laws, changes in taxing jurisdictions’ administrative interpretations, decisions, policies and positions, results of tax examinations, settlements or judicial decisions, changes in accounting principles, or changes to our business operations, including as a result of acquisitions. For example, the U.S. Inflation Reduction Act of 2022 created an excise tax of 1% on the value of any stock repurchased by us after December 31, 2022. During 2024, we have been subject to this excise tax, but the amount will vary depending on various factors, including the amount and frequency of any stock repurchases and any permitted reductions or exceptions to the amount subject to the tax. Any resulting increase in our tax obligation or cash taxes paid could adversely affect our financial position and cash flows.
Rearranged current paragraphs (3)

Current report — wording carried from elsewhere

Acquisitions may also result in potentially dilutive issuances of equity securities, the incurrence of debt and contingent liabilities, the expenditure of available cash, and amortization expenses or write-downs related to intangible assets such as goodwill, any of which could have a material adverse effect on our operating results or financial condition. For example, in December 2024, we recorded a material noncash impairment charge related to EVERFI (See Note 3 to our consolidated financial statements in this report for more information).

Current report — wording carried from elsewhere

•We previously received notices of governmental actions or investigations by the U.S. Department of Health and Human Services, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner of Canada, each of which we now believe are now longer active actions or investigations.

Current report — wording carried from elsewhere

See Note 11 to our consolidated financial statements included in this report for a more detailed description of the Security Incident and related matters.